You need to deny them access to the sites they should not be able to
reach somehow. If you first allow them access to the restricted sites
and then also allow everyone (including them) access to everything
then there is not much of a restriction in place.

Regards
Henrik

--
MARA Systems AB, Giving you basic free Squid support
Customized solutions, packaged solutions and priority support
available on request